Control: severity -1 wishlist On Tue, Nov 04, 2014 at 05:46:08PM +0000, Ian Jackson wrote: > Package: apt > Version: 0.9.7.9+deb7u5 > > apt interprets package names containing `-', `+' and `+' specially, > even when they are supplied as simple command line arguments. These > characters are, of course, literals in package names, which may occur > anywhere other than at the start. > > This is a problem because commands such as > apt-get remove b.sh > apt-get remove bonnie++ > apt-get install bonnie+. > ought to mean to operate on the specified literal package names, > regardless of whether the named packages `exist' (i.e., are known > to this instance of apt). > > Otherwise it is almost impossible for a program which calls apt to > reliable `unparse' the command line: that is, to convert an intended > operation into a command line which instructs apt to always execute > the specified operation.
The only time an issue can appear is if you have two or more packages ending in + or - where one is a prefix of the other. As long as we do not have such packages in the archive, there is no issue. > > In some circumstances this could be a security problem. In which? > > Unfortunately this syntax is probably baked-in in some callers, so we > will have to have a transition plan. At the very least, apt should > currently warn whenever an ambiguous string is interpreted other than > as a literal package name. > > I am thinking of submitting a patch which allows ambiguous package > name specifications to be handled in one of three specified ways, > according to the configuration: > - always treat as literal > - always treat as literal, with warning if behaviour changed > - current behaviour, with warning if behaviour could change > > Would such a patch be welcome ? We can then have a conversation about > what the default should be. > > I would like to press ahead with this regardless of agreement on > replacement metasyntax. I do not agree about deprecating this just because you say you want something else. It works just fine in practice. If you want a replacement, how about allowing +/- prefixes instead? That does not seem ambigous, unless I'm missing something. But I'm not sure it's worth the effort. -- Julian Andres Klode - Debian Developer, Ubuntu Member See http://wiki.debian.org/JulianAndresKlode and http://jak-linux.org/. Be friendly, do not top-post, and follow RFC 1855 "Netiquette". - If you don't I might ignore you. -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
